The most important laws in Italy regulating online sales include:

1. Legislative Decree No. 70 of 9 April 2003 (Decreto Legislativo n. 70 del 9 aprile 2003, so-called “Decreto E-commerce”);
2. Consumer Code of 2005 (Codice del Consumo), as amended by Legislative Decree No. 170 of 2021 (decreto legislativo 170/2021);
3. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).
   

Legislative decree

The provisions of the decree oblige online sellers to, among other things:

• providing the consumer with full and clear information about the price, features of the product or service, delivery times and costs, as well as payment and delivery methods;
• providing the consumer with a withdrawal form within 14 days of delivery of the product, ensuring the possibility of returning the goods and refunding the price paid.

The aforementioned decree requires sellers to ensure the security of consumer data by implementing the necessary measures to prevent unauthorized access to personal data. However, this legal act does not exhaustively regulate personal data protection, but rather addresses the security of consumer data in the context of the provision of electronic services.

Consumer Code

In turn, the code regulates issues such as:

• your name and contact details, as well as any other information that identifies the seller;
• rules regarding concluding distance contracts, in particular complaints and withdrawal from the contract;
• the method of communication between the seller and the consumer.

In 2021, the above code was amended by legislative decree following a change in EU regulations regarding sellers’ liability for the conformity of goods with the contract (i.e. complaints).

Consumers have the right to withdraw from the contract (also known as the "right to change their mind") without giving any reason within 14 calendar days of receiving the goods. However, there are exceptions. For example, if the goods are manufactured according to the consumer's specifications, the consumer loses the right to withdraw from the contract.

Failure by the seller to inform the consumer of the right to withdraw from the contract has significant consequences. The withdrawal period is then extended from 14 days to 12 months. After informing the consumer of this right, they have another 14 days to exercise it. In such a case, the seller bears the cost of returning the goods.

Furthermore, a seller offering the possibility for the consumer to submit a declaration of intent on its website is obliged to immediately notify the consumer of receipt of the declaration of withdrawal on a durable medium.

From 2022, the presumption of non-conformity of goods with the contract has been extended from 6 months to 12 months . This means that if a consumer reports a defect within one year of purchase, the seller must prove that the product conformed with the contract at the time of sale. After this period, this obligation rests with the consumer.

It's important to note that in Italy, consumers are not limited to a two-month deadline to notify the seller of a product's lack of conformity with the contract. They can do so within two years, i.e., within the duration of the seller's liability for the product's lack of conformity.

If the goods do not conform to the contract, the consumer is entitled to a claim for repair or replacement, price reduction or termination of the contract.

The Polish equivalent of the Personal Data Protection Act is the Personal Data Protection Act. It's important to remember that running an online store necessarily involves processing the personal data of users who visit your website.

Therefore, please note that in addition to the store's terms and conditions and checkboxes for acceptance, a privacy policy should be drafted and posted on the store's website. It should contain at least the following information:

• Data controller details – i.e. information identifying the store owner, such as name and surname (or company name), registered office address and contact details.
• Purposes and method of data processing – explanation of what personal data will be collected, for what purpose and using what methods.
• Sharing data with third parties – information about possible data transfer, indication of recipients and the purpose of such sharing.
• User rights – a description of the rights of data subjects, such as the right to access, rectify, delete data or object to their processing.
• Cookies and tracking technologies – clearly defining what cookies are used, for what purposes, and how the user can manage consent.

Please note that unless the processing of personal data is based on a contract or legal obligation, the user's express and voluntary consent to the processing of personal data is required. This applies, for example, to sending a newsletter.

Failure to comply with personal data protection regulations may result in the imposition of a financial penalty by the Italian equivalent of the Personal Data Protection Office (AGCM).